What’s Wrong with Manufacturing?

In
last
year’s
edition
of
the

Security
Navigator
we
noted
that
the
Manufacturing
Industry
appeared
to
be
totally
over-represented
in
our
dataset
of
Cyber
Extortion
victims.
Neither
the
number
of
businesses
nor
their
average
revenue
particularly
stood
out
to
explain
this.

Manufacturing
was
also
the
most
represented
Industry
in
our
CyberSOC
dataset
–
contributing
more
Incidents
than
any
other
sector.

We
found
this
trend
confirmed
in
2023
–
so
much
in
fact
that
we
decided
to
take
a
closer
look.
So
let’s
examine
some
possible
explanations.

And
debunk
them.

Hunting
for
possible
explanations

Manufacturing
is
still
the
most
impacted
industry
in
our
Cyber
Extortion
dataset
in
2023,
as
tracked
by
monitoring
double-extortion
leak
sites.
Indeed,
this
sector
now
represents
more
than
20%
of
all
victims
since
we
started
observing
the
leak
sites
in
the
beginning
of
2020.

Approximately
28%
of
all
our
clients
are
from
Manufacturing,
contributing
with
an
overall
share
of
31%
of
all
potential
incidents
we
investigated.

We
note
that
58%
of
the
Incidents
this
industry
deals
with
are
internally
caused,
32%
were
externally
caused,
1%
was
classified
as
“Partner”
or
3rd
parties.
When
external
threat
actors
had
caused
the
security
incident,
we
observed
the
top
3
threat
actions
were
Web
Attacks,
Port
Scanning
and
Phishing.

On
the
other
hand,
Manufacturing
has
the
lowest
apparent
number
of
confirmed
security
vulnerabilities
per
IT
Asset
in
our
Vulnerability
scanning
dataset.
Our
pentesting
teams
on
the
other
hand
report
4.81
CVSS
findings
per
day,
which
is
quite
a
bit
above
the
average
of
3.61
across
all
other
industries.

Several
questions
present
themselves,
which
we
will
attempt
to
examine
here:

1. What
   part
   does
   Operation
   Technology
   play?
2. Are
   businesses
   in
   Manufacturing
   more
   vulnerable?
3. Is
   the
   Manufacturing
   sector
   being
   deliberately
   targeted
   more?
4. Do
   our
   Manufacturing
   clients
   experience
   more
   incidents?

What
part
does
OT
play?

A
tempting
assumption
to
make
is
that
businesses
in
the
Manufacturing
sector
are
compromised
more
often
via
notoriously
insecure
Operational
Technology
(OT)
or
Internet
of
Things
(IoT)
systems.
Plants
and
factories
can
often
not
afford
to
be
disrupted
or
shut
down
and
that
Manufacturing
is
therefore
a
soft
target
for
extortionists.

It
sure
sounds
plausible.
The
catch
is:
we
don’t
see
these
theories
supported
in
our
data.

The
attack
against
US
Energy
giant
Colonial
Pipeline
was
probably
the
most
notable
recent
example
of
a
successful
attack
against
an
industrial
facility.

In
July
this
year
US
intelligence
agencies
even
warned
of
a
hacking
toolset
dubbed
‘Pipedream’
that
is
designed
target
specific
Industrial
Control
Systems.
But
it
is
not
clear
to
us
if
or
when
these
tools
have
ever
been
encountered
in
the
wild.
Apart
from
the
infamous
Stuxnet
attack
from
2010,
one
struggles
to
recall
a
single
cyber
security
incident
where
the
entry
point
was
an
OT
system.

At
Colonial
Pipeline
the
backend
‘conventional’
administrative
systems
were
compromised
first.
Looking
more
closely,
this
is
the
case
for
almost
all
reported
incidents
at
industrial
facilities.

Are
businesses
in
the
Manufacturing
sector
more
vulnerable
to
attacks?

To
answer
this
questions
we
examined
a
set
of
3
million
vulnerability
scan
findings,
and
a
sample
of
1,400
Ethical
Hacking
reports.

We
derived
three
metrics
that
facilitate
somewhat
normalized
comparisons
across
the
industries
in
our
client
base:

VOC
scanning
findings
per
asset,
time
to
patch,
Pentest
findings
per
day
of
testing.

If
we
rank
industries
for
their
performance
on
each
of
those
metrics
and
sort
from
worst
to
best,
then
our
clients
in
the
Manufacturing
sector
arrives
in
5th
place
out
of
12
comparable
industries.

The
chart
below
shows
the
overall
*ranking*
of
our
Manufacturing
clients
out
of
comparable
industries.

VOC
unique
findings/asset

On
this
metric
there
were
seven
other
industries
that
performed
better
than
Manufacturing.

While
we
have
a
comparatively
high
number
of
assets
from
Manufacturing
clients
in
our
scanning
dataset,
we
report
far
fewer
Findings
per
Asset
than
the
average
across
all
industries.
Almost
10
times
fewer,
in
fact.

Time
to
patch

On
this
metric
6
other
industries
ranked
better
than
Manufacturing.
The
average
age
of
all
findings
for
this
industry
is
419
days,
which
is
a
concerning
number
and
worse
than
recorded
for
eight
other
industries
in
this
dataset.

Pentesting
findings

We
observe
that
the
average
CVSS
Per
Day
was
4.81,
compared
to
3.61
on
average
for
clients
in
all
other
sectors
in
the
dataset
–
33%
higher.

Is
the
Manufacturing
sector
being
targeted
more
by
extortionists?

We
use
the
North
American
Industry
Classification
System
–
NAICS
–
classification
system
when
categorizing
our
clients.

A
consideration
of
double-extortion
victim
counts
per
industry
reveals
a
very
interesting
pattern:
Of
the
10
industries
with
the
most
recorded
victims
in
the
dataset,
7
are
also
counted
amongst
the
biggest
industries
by
entity
count.

Manufacturing
however,
is
a
clear
trend-breaker.

Another
factor
raises
questions:
if
businesses
in
the
Manufacturing
sector
were
more
willing
to
pay
ransom
that
would
make
them
more
attractive
as
victims.
But
then
we
would
expect
to
see
such
businesses
featuring
on
the
‘name
and
shame’
leak
site
less
often,
not
more.

Do
our
Manufacturing
clients
experience
more
incidents?

The
Manufacturing
industry
once
again
generated
the
highest
number
of
Incidents
as
a
percentage
of
the
total
in
our
CyberSOC
dataset.
31%
of
all
Incidents
are
generated
for
the
28%
of
our
clients
that
are
from
this
sector.

The
Incident
data
lacks
context,
however.
To
establish
a
baseline
for
comparison,
we
assign
customers
a
‘Coverage
Score’
between
0
and
5
in
8
different
‘domains’
of
Threat
Detection,
accounting
for
a
maximum
total
detection
score
of
40.

We
use
the
coverage
score
to
normalize
the
incident
count.
Put
simply,
the
lower
a
client’s
assessed
coverage
score
is,
the
more
this
adjustment
will
‘boost’
the
number
of
Incidents
in
this
comparison.
The
logic
is
that
a
low
amount
of
coverage
will
just
not
show
us
a
lot
of
incidents,
though
they
very
likely
occurr.

If
we
adjust
the
True
Positive
and
False
Positive
Incidents
as
described
above,
we
still
see
more
than
seven
times
as
many
Incidents
per
clients
from
Manufacturing
than
the
average
for
all
industries.

In
a
similar
comparison,
limited
only
to
Perimeter
Security,
and
only
Medium
Sized
business,
Manufacturing
ranks
1st
with
the
most
Incidents
per
Customer
out
of
7
comparable
Industries.

Conclusion

We
ruled
out
a
massive
impact
of
OT
security
vulnerabilities,
and
therefore
focus
on
regular
IT
systems.
Our
scanning
teams
assessed
a
large
number
of
targets
but
reported
relatively
few
vulnerabilities
per
asset.
Overall,
we
rank
the
Manufacturing
sector
as
5th
or
6th
weakest
of
all
industries
from
a
vulnerability
point
of
view.

The
question
of
why
we
consistently
record
such
a
high
proportion
of
victims
from
the
Manufacturing
industry
is
not
readily
answered
with
the
data
we
have.
We
believe
that
in
the
end
it
still
comes
down
to
the
level
of
vulnerability,
best
reflected
in
our
Penetration
Testing,
and
Findings
Age
data.

All
of
our
data
points
to
the
fact
that
attackers
are
mostly
opportunistic.
Rather
than
deliberately
singling
industries
out,
they
simply
compromise
businesses
that
are
vulnerable.

The
customers
represented
in
our
datasets
have
engaged
with
us
for
Vulnerability
Assessment
or
Managed
Detection,
and
therefore
represent
relatively
‘mature’
examples
of
that
industry.
We
can
deduce
that
average
businesses
in
this
sector
would
benchmark
worse
in
terms
of
vulnerabilities.
Whether
the
high
number
of
victims
we
observe
on
attacker
leak-sites
is
a
direct
reflection
of
the
high
number
of
overall
victims
in
this
sector,
or
the
skewed
reflection
of
an
industry
that
refuses
to
concede
to
initial
ransom
demands,
is
not
entirely
clear.

What
does
appear
likely,
however,
is
that
vulnerability
is
the
primary
factor
that
determines
which
businesses
get
compromised
and
extorted
–
in
this
sector
as
much
as
any
other.

This
is
just
an
excerpt
of
the
analysis.
More
details
on
how
different
Industries
performed
in
comparison
to
others,
as
well
as
more
CyberSOC,
Pentesting
and
VOC
data
(along
with
plenty
of
other
interesting
research
topics)
can
be
found
in
the

Security
Navigator.
It’s
free
of
charge,
so
have
a
look.
It’s
worth
it!

Note:
This
article
has
been
written
and
contributed
by
Charl
van
der
Walt,
Head
of
Security
Research
at
Orange
Cyberdefense.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts